From 07e2f0e53eb622d78e31e17f38598b5be41995e5 Mon Sep 17 00:00:00 2001
From: Steve Klabnik <steve@steveklabnik.com>
Date: Sat, 8 Dec 2012 11:24:14 -0800
Subject: Security Guide: removing Mass Assignment.
Since mass assignment doesn't exist anymore, we don't need to discuss it.
I checked with @fxn last night before making this change.
---
guides/source/security.md | 135 ----------------------------------------------
1 file changed, 135 deletions(-)
(limited to 'guides/source')
diff --git a/guides/source/security.md b/guides/source/security.md
index 532a1ae5cc..a2a7e5baae 100644
--- a/guides/source/security.md
+++ b/guides/source/security.md
@@ -374,141 +374,6 @@ The common admin interface works like this: it's located at www.example.com/admi
* _Put the admin interface to a special sub-domain_ such as admin.application.com and make it a separate application with its own user management. This makes stealing an admin cookie from the usual domain, www.application.com, impossible. This is because of the same origin policy in your browser: An injected (XSS) script on www.application.com may not read the cookie for admin.application.com and vice-versa.
-Mass Assignment
----------------
-
-WARNING: _Without any precautions `Model.new(params[:model]`) allows attackers to set
-any database column's value._
-
-The mass-assignment feature may become a problem, as it allows an attacker to set
-any model's attributes by manipulating the hash passed to a model's `new()` method:
-
-```ruby
-def signup
- params[:user] # => {name:"ow3ned", admin:true}
- @user = User.new(params[:user])
-end
-```
-
-Mass-assignment saves you much work, because you don't have to set each value
-individually. Simply pass a hash to the `new` method, or `assign_attributes=`
-a hash value, to set the model's attributes to the values in the hash. The
-problem is that it is often used in conjunction with the parameters (params)
-hash available in the controller, which may be manipulated by an attacker.
-He may do so by changing the URL like this:
-
-```
-http://www.example.com/user/signup?user[name]=ow3ned&user[admin]=1
-```
-
-This will set the following parameters in the controller:
-
-```ruby
-params[:user] # => {name:"ow3ned", admin:true}
-```
-
-So if you create a new user using mass-assignment, it may be too easy to become
-an administrator.
-
-Note that this vulnerability is not restricted to database columns. Any setter
-method, unless explicitly protected, is accessible via the `attributes=` method.
-In fact, this vulnerability is extended even further with the introduction of
-nested mass assignment (and nested object forms) in Rails 2.3. The
-`accepts_nested_attributes_for` declaration provides us the ability to extend
-mass assignment to model associations (`has_many`, `has_one`,
-`has_and_belongs_to_many`). For example:
-
-```ruby
- class Person < ActiveRecord::Base
- has_many :children
-
- accepts_nested_attributes_for :children
- end
-
- class Child < ActiveRecord::Base
- belongs_to :person
- end
-```
-
-As a result, the vulnerability is extended beyond simply exposing column
-assignment, allowing attackers the ability to create entirely new records
-in referenced tables (children in this case).
-
-### Countermeasures
-
-To avoid this, Rails provides an interface for protecting attributes from
-end-user assignment called Strong Parameters. This makes Action Controller
-parameters forbidden until they have been whitelisted, so you will have to
-make a conscious choice about which attributes to allow for mass assignment
-and thus prevent accidentally exposing that which shouldn’t be exposed.
-
-NOTE. Before Strong Parameters arrived, mass-assignment protection was a
-model's task provided by Active Model. This has been extracted to the
-[ProtectedAttributes](https://github.com/rails/protected_attributes)
-gem. In order to use `attr_accessible` and `attr_protected` helpers in
-your models, you should add `protected_attributes` to your Gemfile.
-
-Why we moved mass-assignment protection out of the model and into
-the controller? The whole point of the controller is to control the
-flow between user and application, including authentication, authorization,
-and, as part of that, access control.
-
-Strong Parameters provides two methods to the `params` hash to control
-access to your attributes: `require` and `permit`. The former is used
-to mark parameters as required and the latter limits which attributes
-should be allowed for mass updating using the slice pattern. For example:
-
-```ruby
-def signup
- params[:user]
- # => {name:"ow3ned", admin:true}
- permitted_params = params.require(:user).permit(:name)
- # => {name:"ow3ned"}
-
- @user = User.new(permitted_params)
-end
-```
-
-In the example above, `require` is checking whether a `user` key is present or not
-in the parameters, if it's not present, it'll raise an `ActionController::MissingParameter`
-exception, which will be caught by `ActionController::Base` and turned into a
-400 Bad Request reply. Then `permit` whitelists the attributes that should be
-allowed for mass assignment.
-
-A good pattern to encapsulate the permissible parameters is to use a private method
-since you'll be able to reuse the same permit list between different actions.
-
-```ruby
-def signup
- @user = User.new(user_params)
- # ...
-end
-
-def update
- @user = User.find(params[:id]
- @user.update_attributes!(user_params)
- # ...
-end
-
-private
- def user_params
- params.require(:user).permit(:name)
- end
-```
-
-Also, you can specialize this method with per-user checking of permissible
-attributes.
-
-```ruby
-def user_params
- if current_user.admin?
- params.require(:user).permit(:name, :admin)
- else
- params.require(:user).permit(:name)
- end
-end
-```
-
User Management
---------------
--
cgit v1.2.3
From 0939a812a0179fdc77b69b11f1e86c68b30ea217 Mon Sep 17 00:00:00 2001
From: Henare Degan <henare.degan@gmail.com>
Date: Sun, 9 Dec 2012 23:17:33 +1100
Subject: Globalize2 is only compatible with Rails 2 so link to Globalize3
instead
---
guides/source/i18n.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/i18n.md b/guides/source/i18n.md
index 399a4963d7..2e61bea5ea 100644
--- a/guides/source/i18n.md
+++ b/guides/source/i18n.md
@@ -96,7 +96,7 @@ This means, that in the `:en` locale, the key _hello_ will map to the _Hello wor
The I18n library will use **English** as a **default locale**, i.e. if you don't set a different locale, `:en` will be used for looking up translations.
-NOTE: The i18n library takes a **pragmatic approach** to locale keys (after [some discussion](http://groups.google.com/group/rails-i18n/browse_thread/thread/14dede2c7dbe9470/80eec34395f64f3c?hl=en), including only the _locale_ ("language") part, like `:en`, `:pl`, not the _region_ part, like `:en-US` or `:en-GB`, which are traditionally used for separating "languages" and "regional setting" or "dialects". Many international applications use only the "language" element of a locale such as `:cs`, `:th` or `:es` (for Czech, Thai and Spanish). However, there are also regional differences within different language groups that may be important. For instance, in the `:en-US` locale you would have $ as a currency symbol, while in `:en-GB`, you would have £. Nothing stops you from separating regional and other settings in this way: you just have to provide full "English - United Kingdom" locale in a `:en-GB` dictionary. Various [Rails I18n plugins](http://rails-i18n.org/wiki) such as [Globalize2](https://github.com/joshmh/globalize2/tree/master) may help you implement it.
+NOTE: The i18n library takes a **pragmatic approach** to locale keys (after [some discussion](http://groups.google.com/group/rails-i18n/browse_thread/thread/14dede2c7dbe9470/80eec34395f64f3c?hl=en), including only the _locale_ ("language") part, like `:en`, `:pl`, not the _region_ part, like `:en-US` or `:en-GB`, which are traditionally used for separating "languages" and "regional setting" or "dialects". Many international applications use only the "language" element of a locale such as `:cs`, `:th` or `:es` (for Czech, Thai and Spanish). However, there are also regional differences within different language groups that may be important. For instance, in the `:en-US` locale you would have $ as a currency symbol, while in `:en-GB`, you would have £. Nothing stops you from separating regional and other settings in this way: you just have to provide full "English - United Kingdom" locale in a `:en-GB` dictionary. Various [Rails I18n plugins](http://rails-i18n.org/wiki) such as [Globalize3](https://github.com/svenfuchs/globalize3) may help you implement it.
The **translations load path** (`I18n.load_path`) is just a Ruby Array of paths to your translation files that will be loaded automatically and available in your application. You can pick whatever directory and translation file naming scheme makes sense for you.
--
cgit v1.2.3
From 5c2eb889c204f3de33b1cea2c7bc8b8469ec7254 Mon Sep 17 00:00:00 2001
From: Andy Lindeman <alindeman@gmail.com>
Date: Mon, 10 Dec 2012 13:43:29 -0500
Subject: `config.action_mailer.async` is no longer used
---
guides/source/action_mailer_basics.md | 1 -
1 file changed, 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/action_mailer_basics.md b/guides/source/action_mailer_basics.md
index aaf04f4256..6bb3439e5e 100644
--- a/guides/source/action_mailer_basics.md
+++ b/guides/source/action_mailer_basics.md
@@ -516,7 +516,6 @@ The following configuration options are best made in one of the environment file
|`perform_deliveries`|Determines whether deliveries are actually carried out when the `deliver` method is invoked on the Mail message. By default they are, but this can be turned off to help functional testing.|
|`deliveries`|Keeps an array of all the emails sent out through the Action Mailer with delivery_method :test. Most useful for unit and functional testing.|
|`default_options`|Allows you to set default values for the `mail` method options (`:from`, `:reply_to`, etc.).|
-|`async`|Setting this flag will turn on asynchronous message sending, message rendering and delivery will be pushed to `Rails.queue` for processing.|
### Example Action Mailer Configuration
--
cgit v1.2.3
From d4d9e1f9bf2388a34dc6b7b9473ee14cda3166df Mon Sep 17 00:00:00 2001
From: Steve Klabnik <steve@steveklabnik.com>
Date: Mon, 10 Dec 2012 11:01:21 -0800
Subject: Add multipart: true to form for file upload.
I was slightly overzealous when removing this before.
Identified here: https://github.com/rails/rails/commit/ed78770b1a13788a5d3fcae484f34654de580bd5\#commitcomment-2281181
---
guides/source/action_view_overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/action_view_overview.md b/guides/source/action_view_overview.md
index 6c2871d478..4cdac43a7e 100644
--- a/guides/source/action_view_overview.md
+++ b/guides/source/action_view_overview.md
@@ -1264,7 +1264,7 @@ Creates a field set for grouping HTML form elements.
Creates a file upload field.
```html+erb
-<%= form_tag {action: "post"} do %>
+<%= form_tag {action: "post"}, {multipart: true} do %>
<label for="file">File to Upload</label> <%= file_field_tag "file" %>
<%= submit_tag %>
<% end %>
--
cgit v1.2.3
From 336bbb17e335323c0828165dd8f8f09b627664f1 Mon Sep 17 00:00:00 2001
From: Florent Guilleux <florent2@gmail.com>
Date: Mon, 10 Dec 2012 18:47:21 -0500
Subject: Document adding member route without the option
---
guides/source/routing.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/routing.md b/guides/source/routing.md
index 241a7cfec6..5bf31a1583 100644
--- a/guides/source/routing.md
+++ b/guides/source/routing.md
@@ -471,7 +471,7 @@ resources :photos do
end
```
-This will recognize `/photos/1/preview` with GET, and route to the `preview` action of `PhotosController`. It will also create the `preview_photo_url` and `preview_photo_path` helpers.
+This will recognize `/photos/1/preview` with GET, and route to the `preview` action of `PhotosController`, with the resource id value passed in `params[:id]`. It will also create the `preview_photo_url` and `preview_photo_path` helpers.
Within the block of member routes, each route name specifies the HTTP verb that it will recognize. You can use `get`, `patch`, `put`, `post`, or `delete` here. If you don't have multiple `member` routes, you can also pass `:on` to a route, eliminating the block:
@@ -481,6 +481,8 @@ resources :photos do
end
```
+You can leave out the `:on` option, this will create the same member route except that the resource id value will be available in `params[:photo_id]` instead of `params[:id]`.
+
#### Adding Collection Routes
To add a route to the collection:
--
cgit v1.2.3
From 46d63d5b209e170687860ce4122b07070342c3ba Mon Sep 17 00:00:00 2001
From: Francesco Rodriguez <lrodriguezsanc@gmail.com>
Date: Mon, 10 Dec 2012 19:04:11 -0500
Subject: =?UTF-8?q?remove=20Mass=20Assignment=20reference=20from=20Securit?=
=?UTF-8?q?y=20Guide=C2=A0[ci=20skip]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
guides/source/security.md | 1 -
1 file changed, 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/security.md b/guides/source/security.md
index a2a7e5baae..8096ea2383 100644
--- a/guides/source/security.md
+++ b/guides/source/security.md
@@ -554,7 +554,6 @@ NOTE: _When sanitizing, protecting or verifying something, whitelists over black
A blacklist can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a whitelist which lists the good e-mail addresses, public actions, good HTML tags and so on. Although sometimes it is not possible to create a whitelist (in a SPAM filter, for example), _prefer to use whitelist approaches_:
* Use before_action only: [...] instead of except: [...]. This way you don't forget to turn it off for newly added actions.
-* Use attr_accessible instead of attr_protected. See the mass-assignment section for details
* Allow <strong> instead of removing <script> against Cross-Site Scripting (XSS). See below for details.
* Don't try to correct user input by blacklists:
* This will make the attack work: "<sc<script>ript>".gsub("<script>", "")
--
cgit v1.2.3
From 1e83730067709d8c07fd25669088e8e9efd2355b Mon Sep 17 00:00:00 2001
From: Francesco Rodriguez <lrodriguezsanc@gmail.com>
Date: Mon, 10 Dec 2012 19:07:25 -0500
Subject: remove Mass Assignment reference from Form Helpers guide [ci skip]
---
guides/source/form_helpers.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/form_helpers.md b/guides/source/form_helpers.md
index ee563e72d5..8ab44ea0bb 100644
--- a/guides/source/form_helpers.md
+++ b/guides/source/form_helpers.md
@@ -458,7 +458,7 @@ As with other helpers, if you were to use the `select` helper on a form builder
<%= f.select(:city_id, ...) %>
```
-WARNING: If you are using `select` (or similar helpers such as `collection_select`, `select_tag`) to set a `belongs_to` association you must pass the name of the foreign key (in the example above `city_id`), not the name of association itself. If you specify `city` instead of `city_id` Active Record will raise an error along the lines of ` ActiveRecord::AssociationTypeMismatch: City(#17815740) expected, got String(#1138750) ` when you pass the `params` hash to `Person.new` or `update_attributes`. Another way of looking at this is that form helpers only edit attributes. You should also be aware of the potential security ramifications of allowing users to edit foreign keys directly. You may wish to consider the use of `attr_protected` and `attr_accessible`. For further details on this, see the [Ruby On Rails Security Guide](security.html#mass-assignment).
+WARNING: If you are using `select` (or similar helpers such as `collection_select`, `select_tag`) to set a `belongs_to` association you must pass the name of the foreign key (in the example above `city_id`), not the name of association itself. If you specify `city` instead of `city_id` Active Record will raise an error along the lines of ` ActiveRecord::AssociationTypeMismatch: City(#17815740) expected, got String(#1138750) ` when you pass the `params` hash to `Person.new` or `update_attributes`. Another way of looking at this is that form helpers only edit attributes. You should also be aware of the potential security ramifications of allowing users to edit foreign keys directly.
### Option Tags from a Collection of Arbitrary Objects
--
cgit v1.2.3
From c04dc674cceef76408eb7f22e30c7ffc36c9262d Mon Sep 17 00:00:00 2001
From: Francesco Rodriguez <lrodriguezsanc@gmail.com>
Date: Mon, 10 Dec 2012 19:08:09 -0500
Subject: remove attr_protected reference from AS Core Extensions guide [ci
skip]
---
guides/source/active_support_core_extensions.md | 7 -------
1 file changed, 7 deletions(-)
(limited to 'guides/source')
diff --git a/guides/source/active_support_core_extensions.md b/guides/source/active_support_core_extensions.md
index 1d79ee2565..61968b1eb9 100644
--- a/guides/source/active_support_core_extensions.md
+++ b/guides/source/active_support_core_extensions.md
@@ -2678,13 +2678,6 @@ If the receiver responds to `convert_key`, the method is called on each of the a
{a: 1}.with_indifferent_access.except("a") # => {}
```
-The method `except` may come in handy for example when you want to protect some parameter that can't be globally protected with `attr_protected`:
-
-```ruby
-params[:account] = params[:account].except(:plan_id) unless admin?
-@account.update_attributes(params[:account])
-```
-
There's also the bang variant `except!` that removes keys in the very receiver.
NOTE: Defined in `active_support/core_ext/hash/except.rb`.
--
cgit v1.2.3
From 6e98989c95c3e90ffef4ddad891d0893ef08f26f Mon Sep 17 00:00:00 2001
From: George Claghorn <george@georgeclaghorn.com>
Date: Tue, 11 Dec 2012 04:29:19 -0500
Subject: Update guides/source/routing.md
It's no longer necessary to delete public/index.html for the root route to take effect.
---
guides/source/routing.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/routing.md b/guides/source/routing.md
index 5bf31a1583..14f23d4020 100644
--- a/guides/source/routing.md
+++ b/guides/source/routing.md
@@ -793,7 +793,7 @@ root to: 'pages#main'
root 'pages#main' # shortcut for the above
```
-You should put the `root` route at the top of the file, because it is the most popular route and should be matched first. You also need to delete the `public/index.html` file for the root route to take effect.
+You should put the `root` route at the top of the file, because it is the most popular route and should be matched first.
NOTE: The `root` route only routes `GET` requests to the action.
--
cgit v1.2.3
From 019b38999d8bc7e1f33b89a85279a43c89b29672 Mon Sep 17 00:00:00 2001
From: Pablo Torres <tn.pablo@gmail.com>
Date: Tue, 11 Dec 2012 22:15:41 -0500
Subject: Remove deprecated Time methods from the guides [ci skip]
Don't use:
* Time.time_with_datetime_fallback
* Time.utc_time
* Time.local_time
---
guides/source/active_support_core_extensions.md | 24 ++----------------------
1 file changed, 2 insertions(+), 22 deletions(-)
(limited to 'guides/source')
diff --git a/guides/source/active_support_core_extensions.md b/guides/source/active_support_core_extensions.md
index 61968b1eb9..23736020ec 100644
--- a/guides/source/active_support_core_extensions.md
+++ b/guides/source/active_support_core_extensions.md
@@ -3592,7 +3592,7 @@ Time.zone_default
# => #<ActiveSupport::TimeZone:0x7f73654d4f38 @utc_offset=nil, @name="Madrid", ...>
# In Barcelona, 2010/03/28 02:00 +0100 becomes 2010/03/28 03:00 +0200 due to DST.
-t = Time.local_time(2010, 3, 28, 1, 59, 59)
+t = Time.local(2010, 3, 28, 1, 59, 59)
# => Sun Mar 28 01:59:59 +0100 2010
t.advance(seconds: 1)
# => Sun Mar 28 03:00:00 +0200 2010
@@ -3647,26 +3647,6 @@ Time.current
Analogously to `DateTime`, the predicates `past?`, and `future?` are relative to `Time.current`.
-Use the `local_time` class method to create time objects honoring the user time zone:
-
-```ruby
-Time.zone_default
-# => #<ActiveSupport::TimeZone:0x7f73654d4f38 @utc_offset=nil, @name="Madrid", ...>
-Time.local_time(2010, 8, 15)
-# => Sun Aug 15 00:00:00 +0200 2010
-```
-
-The `utc_time` class method returns a time in UTC:
-
-```ruby
-Time.zone_default
-# => #<ActiveSupport::TimeZone:0x7f73654d4f38 @utc_offset=nil, @name="Madrid", ...>
-Time.utc_time(2010, 8, 15)
-# => Sun Aug 15 00:00:00 UTC 2010
-```
-
-Both `local_time` and `utc_time` accept up to seven positional arguments: year, month, day, hour, min, sec, usec. Year is mandatory, month and day default to 1, and the rest default to 0.
-
If the time to be constructed lies beyond the range supported by `Time` in the runtime platform, usecs are discarded and a `DateTime` object is returned instead.
#### Durations
@@ -3685,7 +3665,7 @@ now - 1.week
They translate to calls to `since` or `advance`. For example here we get the correct jump in the calendar reform:
```ruby
-Time.utc_time(1582, 10, 3) + 5.days
+Time.utc(1582, 10, 3) + 5.days
# => Mon Oct 18 00:00:00 UTC 1582
```
--
cgit v1.2.3
From 2cdf6bda4a34c9e20eb0af41ccb18a4bcb192aed Mon Sep 17 00:00:00 2001
From: Pablo Torres <tn.pablo@gmail.com>
Date: Wed, 12 Dec 2012 12:01:37 -0500
Subject: Add #destroy! as a method that triggers callbacks
---
guides/source/active_record_callbacks.md | 1 +
1 file changed, 1 insertion(+)
(limited to 'guides/source')
diff --git a/guides/source/active_record_callbacks.md b/guides/source/active_record_callbacks.md
index 971c1cdb25..0a93f61f6d 100644
--- a/guides/source/active_record_callbacks.md
+++ b/guides/source/active_record_callbacks.md
@@ -150,6 +150,7 @@ The following methods trigger callbacks:
* `create!`
* `decrement!`
* `destroy`
+* `destroy!`
* `destroy_all`
* `increment!`
* `save`
--
cgit v1.2.3
From e927ba9953519bcd2819a61800a160c9d4dbaf12 Mon Sep 17 00:00:00 2001
From: Anuj Dutta <anuj@andhapp.com>
Date: Thu, 13 Dec 2012 16:28:43 +0000
Subject: Add a small note about the compressing the file, and how that helps
the application.
---
guides/source/asset_pipeline.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/asset_pipeline.md b/guides/source/asset_pipeline.md
index ff6787dae5..10ba3ab23a 100644
--- a/guides/source/asset_pipeline.md
+++ b/guides/source/asset_pipeline.md
@@ -272,7 +272,8 @@ $('#logo').attr src: "<%= asset_path('logo.png') %>"
### Manifest Files and Directives
-Sprockets uses manifest files to determine which assets to include and serve. These manifest files contain _directives_ — instructions that tell Sprockets which files to require in order to build a single CSS or JavaScript file. With these directives, Sprockets loads the files specified, processes them if necessary, concatenates them into one single file and then compresses them (if `Rails.application.config.assets.compress` is true). By serving one file rather than many, the load time of pages can be greatly reduced because the browser makes fewer requests.
+Sprockets uses manifest files to determine which assets to include and serve. These manifest files contain _directives_ — instructions that tell Sprockets which files to require in order to build a single CSS or JavaScript file. With these directives, Sprockets loads the files specified, processes them if necessary, concatenates them into one single file and then compresses them (if `Rails.application.config.assets.compress` is true). By serving one file rather than many, the load time of pages can be greatly reduced because the browser makes fewer requests. In addition, compressing one concatenated file, reduces the file size and the browser can download it quicker.
+
For example, a new Rails application includes a default `app/assets/javascripts/application.js` file which contains the following lines:
--
cgit v1.2.3
From d5badea28c77f2176bdac9bf68a0e2c3c30fecd3 Mon Sep 17 00:00:00 2001
From: Jay Hayes <jay.hayes@dynetics.com>
Date: Thu, 13 Dec 2012 13:58:49 -0600
Subject: Fix associations presence lost in steve's reformat
https://github.com/lifo/docrails/commit/55a2820cc6d33e96b8d1b64b38b033913058dce4
messes up
https://github.com/lifo/docrails/commit/cfd324b4b68469ba3188e4b7ba8586e59b239693
Hopefully there is other stuff lost in translation...
---
guides/source/active_record_validations.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
(limited to 'guides/source')
diff --git a/guides/source/active_record_validations.md b/guides/source/active_record_validations.md
index 2e2f0e4ea9..25a0f86ae3 100644
--- a/guides/source/active_record_validations.md
+++ b/guides/source/active_record_validations.md
@@ -503,8 +503,8 @@ end
```
If you want to be sure that an association is present, you'll need to test
-whether the foreign key used to map the association is present, and not the
-associated object itself.
+whether the associated object itself is present, and not the foreign key used
+to map the association.
```ruby
class LineItem < ActiveRecord::Base
--
cgit v1.2.3
From 948c1e506c63fc1e74fd24d8ca73cfc6de0e725f Mon Sep 17 00:00:00 2001
From: Jay Hayes <jay.hayes@dynetics.com>
Date: Thu, 13 Dec 2012 14:04:21 -0600
Subject: Elaborate using `inverse_of` with presence validation
---
guides/source/active_record_validations.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
(limited to 'guides/source')
diff --git a/guides/source/active_record_validations.md b/guides/source/active_record_validations.md
index 25a0f86ae3..ab7487293d 100644
--- a/guides/source/active_record_validations.md
+++ b/guides/source/active_record_validations.md
@@ -513,7 +513,8 @@ class LineItem < ActiveRecord::Base
end
```
-You should also be sure to have a proper `:inverse_of` as well:
+In order to validate associated records whose presence is required, you must
+specify the `:inverse_of` the association:
```ruby
class Order < ActiveRecord::Base
--
cgit v1.2.3
From 561e5ab82eb24335f76961d437a16f09b4a15474 Mon Sep 17 00:00:00 2001
From: Vijay Dev <vijaydev.cse@gmail.com>
Date: Sat, 15 Dec 2012 21:15:05 +0530
Subject: copy editing [ci skip]
---
guides/source/active_record_validations.md | 2 +-
guides/source/asset_pipeline.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
(limited to 'guides/source')
diff --git a/guides/source/active_record_validations.md b/guides/source/active_record_validations.md
index ab7487293d..88d52cb829 100644
--- a/guides/source/active_record_validations.md
+++ b/guides/source/active_record_validations.md
@@ -514,7 +514,7 @@ end
```
In order to validate associated records whose presence is required, you must
-specify the `:inverse_of` the association:
+specify the `:inverse_of` option for the association:
```ruby
class Order < ActiveRecord::Base
diff --git a/guides/source/asset_pipeline.md b/guides/source/asset_pipeline.md
index 10ba3ab23a..743a04ed42 100644
--- a/guides/source/asset_pipeline.md
+++ b/guides/source/asset_pipeline.md
@@ -272,7 +272,7 @@ $('#logo').attr src: "<%= asset_path('logo.png') %>"
### Manifest Files and Directives
-Sprockets uses manifest files to determine which assets to include and serve. These manifest files contain _directives_ — instructions that tell Sprockets which files to require in order to build a single CSS or JavaScript file. With these directives, Sprockets loads the files specified, processes them if necessary, concatenates them into one single file and then compresses them (if `Rails.application.config.assets.compress` is true). By serving one file rather than many, the load time of pages can be greatly reduced because the browser makes fewer requests. In addition, compressing one concatenated file, reduces the file size and the browser can download it quicker.
+Sprockets uses manifest files to determine which assets to include and serve. These manifest files contain _directives_ — instructions that tell Sprockets which files to require in order to build a single CSS or JavaScript file. With these directives, Sprockets loads the files specified, processes them if necessary, concatenates them into one single file and then compresses them (if `Rails.application.config.assets.compress` is true). By serving one file rather than many, the load time of pages can be greatly reduced because the browser makes fewer requests. Compression also reduces the file size enabling the browser to download it faster.
For example, a new Rails application includes a default `app/assets/javascripts/application.js` file which contains the following lines:
--
cgit v1.2.3